REMARKS/ARGUMENTS 

This paper is being provided in response to the Office Action dated June 16, 2009 for the 
above-referenced application. 

The rejection of Claims 1, 3-4, 22, 24, 25, 41, 43, 44, 46-52, 63-66 and 71 under 35 
U.S.C. 103(a) as being unpatentable over U.S. Patent No. 6,928,555 to Drew (hereinafter 
"Drew") in view of Stang, David, "Comparison: Products to Detect changes to Program", 1991, 
(hereinafter "Stang") is hereby traversed and reconsideration thereof is respectfully requested. 

It is noted that the top of page 3 of the Office Action appears to erroneously indicate this 
rejection as applied to Claims 1, 3-7, 22, 24-28, 41, 44-52, 63-66, and 71. However, as best 
Applicant can determine based on additional detail supporting the claim rejections set forth on 
subsequent pages in the Office Action and existing claim dependencies, this rejection appears to 
apply to Claims 1, 3-4, 22, 24, 25, 41, 43, 44, 46-52, 63-66 and 71 as will be addressed below. 

Claim 1 recites a computer implemented method of scanning a storage device for viruses, 
comprising: determining, by the storage device, each track of the storage device that has been 
accessed for a write operation since a previous virus scan using information about tracks of the 
storage device without using file-based information, the file-based information including 
information about file structure, file system, and file type; providing, to an antivirus unit by the 
storage device, information indicating which tracks of the storage device have been accessed for 
a write operation since the previous virus scan; and scanning, by the antivirus unit using the 
information provided by the storage device, at least a portion of each track identified as having 
been accessed for a write operation since the previous virus scan for viruses, wherein scanning is 
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performed without using the file-based information. Claims 3, 4, 63 and 66 depend from 
independent Claim 1 . 

Claim 22 recites a computer program product for scanning a storage device for viruses, 
the computer program product including a computer-readable medium with executable code 
stored thereon for: determining, by the storage device, each track of the storage device that has 
been accessed for a write operation since a previous virus scan using information about tracks of 
the storage device without using file-based information, the file-based information including 
information about file structure, file system, and file type; providing, to an antivirus unit by the 
storage device, information indicating which tracks of the storage device have been accessed for 
a write operation since the previous virus scan; and scanning, by the antivirus unit using the 
information provided by the storage device, at least a portion of each track identified as having 
been accessed for a write operation since the previous virus scan for viruses, wherein scanning is 
performed without using the file-based information. Claims 24, 25 and 64 depend from 
independent Claim 22. 

Claim 41 recites an antivirus unit, comprising: means for coupling to at least one storage 
device; means for determining each track of the storage device that has been accessed for a write 
operation since a previous virus scan using information about tracks of the storage device 
without using file-based information, the file-based information including information about file 
structure, file system, and file type; means for receiving, from the at least one storage device, 
information determined by the at least one storage device indicating which tracks of the at least 
one storage device have been accessed for a write operation since the previous virus scan; and 
means for scanning, using the information provided by the storage device, at least a portion of 

Page 11 of 19 



each track identified as having been accessed for a write operation since the previous virus scan 
for viruses, wherein scanning is performed without using the file-based information. Claims 43, 
44, 46-52, 65 and 71 depend from independent Claim 41. 

The Drew reference discloses a method and apparatus for minimizing file scanning by 
anti-virus programs. Col. 3, lines 40-55 and col. 4, lines 5-25 of Drew are cited by the Office 
Action as support for disclosing determining, by a storage device, each track of the storage 
device that has been accessed for a write operation since a previous scan using information about 
tracks of the storage device; providing to an antivirus unit by the storage device information 
indicating which tracks of the storage device have been accessed for a write operation since the 
previous scan; and scanning, by the antivirus unit using the information provided by the storage 
device, at least a portion of each track identified as having been accessed for a write operation 
since the previous scan for viruses. Col. 3, lines 40-55 of Drew refer to steps of the flowchart of 
Drew's Figure 2 with respect to processing performed with reference to Figure 1 in which an 
antivirus program is included in the network server computer 4. Col. 4, lines 5-25 of Drew 
disclose additional steps concerning determining whether a file was actually written that is 
modified by the user performing some writing step on the open file. The Office Action states 
that Drew is silent on the determining step being performed without using information about a 
file structure, a file system or a file type and performing scanning without using information 
about a file structure, a file system or a file system. 

The Office Action cites to Stang as teaching determining physical portions of the storage 
device that have been modified since a previous virus scan using information about the physical 
portions without using the file-based information which includes information about file structure, 
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file system and file type, and performing scanning without using the file-based information, 
citing to page 15, section Checkup of Stang, 

Applicants 1 independent claims recite a computer-implemented method, computer- 
program product and antivirus unit that include at least the features of determining, by the 
storage device, each track of the storage device that has been accessed for a write operation since 
a previous virus scan using information about tracks of the storage device without using file- 
based information, the file-based information including information about file structure, file 
system, and file type; and scanning, using the information provided by the storage device, at least 
a portion of each track identified as having been accessed for a write operation since the previous 
virus scan for viruses, wherein scanning is performed without using the file-based information. 

Applicants respectfully submit that the references, taken alone or in any combination, do 
not disclose or fairly suggest at least the above-noted features as recited in the independent 
claims. The Office Action states that Drew is silent concerning the above-noted features (see 
page 4 of the Office Action) and cites to Stang as disclosing determining and scanning steps 
without using filed-based information, the file-based information including information about 
file structure, file system and file type. However, in contrast to that as contended by the Office 
Action for reasons set forth in more detail below, it is respectfully submitted that Stang does not 
disclose or fairly suggest at least the above-noted features of the independent claims. 

As indicated above, the Office Action contends that Stang, page 15, section Checkup, 
discloses the above-noted features of Applicant's independent Claims. Page 15, section Checkup 
of Stang, states: 
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Checkup 



Checkup simply processes everything on your hard 
disk, and does not work from any input list. There is 
no upper limit on the number of files that can be 
scanned, other than your patience. Checkup is happy to 
point out that files have been changed, when they 
haven't been. This occurs because Checkup creates one 
X.XUP for every file beginning with X. Thus the 
signature for X . BAT is stored in X.XUPand the 
signatures for X.COM, X.SYS, X.BAK, etc. are 
compared with the contents of this file. With perhaps 
10% of such "claims" wrong, you will lose patience with 
it quickly. Checkup gets a 10 for efficiency, a 0 for 
accuracy . 



The foregoing citation of Stang merely indicates that the Checkup program or product performs 
checking of all files on the hard disk without using an input list of files. However, based on the 
disclosure in Stang, Checkup appears to still operate on files although it checks all such files on 
the hard disk. As noted in the above citation, Checkup points out "files" that have been changed 
and Checkup "creates one X.XUP for every file beginning with X'\ Thus, Checkup as disclosed 
by Stang appears to use filed-based information, such as at least file structure and/or file system 
information. In order for Checkup to determine and point out files that have changed, filed-based 
information, such as at least file structure and/or file system information, has to be used 
otherwise Checkup would not be able to perform such processing. 



Additionally, Stang discloses that Checkup is one program evaluated to catch a virus 
where the operation of Checkup on page 3 of Stang (section CRC-AWARE VIRUSES) is 
described as follows: 

Programs could catch such a virus by using an incremental 
cyclic redundancy check approach. In this approach, files are 
dissected into randomly-sized blocks of data, using dynamic 
block size allocations that allow files as small as one byte to be 
accurately checked. CHECKUP uses this approach. It scans and 
compares every byte of the target files on a block-by-block basis. 
If the recorded file sizes, any of the block CRC comparisons, or 
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the CRC totals do not match, CHECKUP alerts users that the 
target files have been altered. 

As described above, Checkup dissects files into randomly sized blocks of data. Thus, 
Checkup appears to obtain information about what files exist on a drive and then dissects those 
files. The foregoing description of Checkup indicates that file-based information, such as 
information about file structure and/or file system is utilized in order to determine what files 
exist, file location and/or size in order to perform the disclosed dissecting, and the like. 
Furthermore, in addition to the foregoing portion of Stang explicitly stating that Checkup alerts a 
user that a target file has been altered, the foregoing portion also provides insight into the 
processing performed by Stang by indicating that a target file is determined as altered if the 
recorded file size, any of the block CRC comparisons, or the CRC totals do not match. Thus, the 
Checkup program performs processing to determine if a file has been altered using information 
including file size. Information such as file size is file based information such as file structure 
information and/or file system information. Therefore, Stang discloses determining which files 
have changed using file-based information such as including file size. The foregoing is in 
distinct contrast to the above-noted features recited in Claim 1 where the determining and 
scanning steps are performed without using the recited file-based information. 

Furthermore, it is respectfully submitted that the recited determining step determines 
tracks accessed for a write operation since a previous scan and provides such information which 
is then used in the scanning step. Stang neither discloses nor suggests such a use. The Checkup 
program is described in Stang at page 15 as pointing out which files have changed after 
examining all files on the hard disk. Thus, Stang does not disclose or suggest determining tracks 
that have changed or have been accessed for a write operation and then using information about 
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the foregoing in connection with scanning. Rather, Stang discloses that Checkup alerts users to 
what files have changed or have been altered. Stang does not disclose or suggest a determining 
step in which tracks written to since a previous scan are determined, and then performing 
scanning where the scanning uses information about such tracks that have been written to as 
determined from the determining step. 

Thus, the references do not disclose or fairly suggest the above-noted features as recited 
in the independent claims. For at least the foregoing reasons, the references do not disclose or 
suggest the independent claims, and claims that depend therefrom. 

In view of the foregoing, Applicants respectfully request that the rejection be 
reconsidered and withdrawn. 

The rejection of Claims 5-7, 26-28, and 45 under 35 U.S.C. 103(a) as being unpatentable 
over Drew, Stang and Waldin, et al. (US Patent No. 6,094,731, hereinafter "Waldin") is hereby 
traversed and reconsideration thereof is respectfully requested. 

Claims 5-7 depend from Claim 1. Claims 26-28 depend from Claim 22. Claim 45 
depends from Claim 41. For reasons set forth above, Claims 1, 22 and 41 are neither disclosed 
nor suggested by Drew and Stang. The Office Action appear to contend that Waldin discloses 
features of Claims 5-7, 26-28 and 45 which are not disclosed by Drew and/or Stang. Waldin is 
silent regarding any disclosure or suggestion of the above-noted features of the independent 
claims. Thus, combining Drew and Stang with Waldin does not overcome the deficiencies of 
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Drew and Stang with respect to the foregoing above-noted features of the independent Claims 1, 
22 and 41. 



For at least the foregoing reasons, Applicant respectfully submits that the references, 
taken separately or in any combination, do not disclose or suggest the independent Claims 1, 22 
and 41, and claims that depend therefrom. 

In view of the foregoing, Applicant respectfully requests that the rejection be 
reconsidered and withdrawn. 

The rejection of Claims 67-70 under 35 U.S.C. 103(a) as being unpatentable over Drew, 
Stang and Ruff et al. (US Patent No. 6928,555, hereinafter "Ruff 5 ) is hereby traversed and 
reconsideration thereof is respectfully requested. 

Claims 67-70 depend from Claim 1 . For reasons set forth above, Drew and Stang do not 
disclose or suggest Claim 1, and claims that depend therefrom. Ruff is cited on page 6 of the 
Office Action where the Office Action contends that Ruff discloses features of Claims 67-70 
which are not disclosed by Drew and/or Stang. Ruff appears silent regarding any disclosure or 
suggestion of the above-noted features of the independent claims. Thus, combining Drew and 
Stang with Ruff does not overcome the deficiencies of Drew and Stang with respect to the 
foregoing above-noted features of independent Claim 1 . 
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For at least the foregoing reasons, Applicant respectfully submits that the references, 
taken separately or in any combination, do not disclose or suggest independent Claim 1, and 
claims that depend therefrom. 

As noted above, Claims 67-70 which depend from Claim 1 are neither disclosed nor 
suggested by the references for at least the same reasons as Claim 1 . However, Applicant will 
point out some particular features of the dependent claims which are also neither disclosed nor 
suggested by the references. 

Claim 67 recites, in relevant part, wherein the antivirus unit is included in a disk 
controller of the storage device. Claim 68 also recites, in relevant part, wherein the antivirus 
unit is included as software running on the disk controller. As support for disclosing features 
of Claims 67 and 68, Ruff at Col. 7, Line 53-Col. 8, Line 34 is cited. The foregoing citation 
refers to Ruffs Figure 3 which includes a virus detector 312 and virus remover 3 16 in a 
computer system 100. The detector 312 and remover 316 are separate from the controller 306. 
Page 6 of the Office Action states that "Ruff teaches an antivirus unit included in a disk 
controller". However, Applicant cannot locate where in Figure 3, or in the foregoing citation of 
Ruff, is there disclosure or suggestion of the foregoing features of Claims 67 and 68. In 
contrast, Ruffs Figure 3 illustrates the virus detector and remover as part of the computer system 
but not included in the controller. 

Page 6 of the Office Action states that it would have been obvious to employ the 
combination of Drew and Stang with Ruff to achieve a predictable result of including an 
antivirus unit in a disk controller. Applicant respectfully disagrees and fails to see where there is 
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any disclosure or suggestion of the foregoing features of Claims 67 and 68 or how the teachings 
of the references yield, as a predictable result, the recited features of Claims 67 and 68. Rather, 
the rationale set forth in the Office Action to support the rejection appears to rely on 
impermissible hindsight for the above-noted recited features of Claims 67 and 68. 

In view of the foregoing, Applicant respectfully requests that the rejection be 
reconsidered and withdrawn. 

Based on the above, Applicant respectfully requests that the Examiner reconsider and 
withdraw all outstanding rejections and objections. Favorable consideration and allowance are 
earnestly solicited. Should there be any questions after reviewing this paper, the Examiner is 
invited to contact the undersigned at 508-898-8604. 



MUIRHEAD AND SATURNELLI, LLC 
200 Friberg Parkway, Suite 1001 
Westborough, MA 01581 
Tel: (508)898-8604 
Fax: (508) 898-8602 



Date: September 8, 2009 




Anne^Tbaturnelli 
Registration No. 41,290 
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